1. Field of the Invention
The present invention relates to a watch dog timer system which is usually employed as a fault supervisory function for software/hardware in an industrial computer or a fault-tolerant computer.
2. Description of the Related Art
A watch dog timer function is used to detect a stop of a computer arising from a bug of a program or from any other cause particularly where the computer is of the type which must not stop such as an industrial computer or a controller for controlling a machine or a product.
The watch dog timer function is usually useful and is sometimes incorporated in an LSI of a one-chip CPU in recent years. This is because it is a definition of normal operation of a computer that "a computer clears a watch dog timer in a fixed time=a program is operating normally". However, if execution of a program enters a permanent loop which includes clearing of a watch dog timer because of a bug, then because this does not satisfy the definition, the bug cannot be detected.
Further, it is sometimes the case that, when an abnormal value is used as a value to be calculated because of some hardware fault, a system operates in a different manner since the value can possibly be assumed by the system. Thus, it is demanded to detect such abnormal operations of a computer as described above with a high degree of accuracy.
A countermeasure which satisfies the demand is disclosed, for example, in Japanese Patent Laid-Open No. Hei 4-241642 wherein it is defined that a system is operating normally when "check points are cleared" using a pass state indication register and "a watch dog timer is cleared" to detect abnormal operation of the system.
According to the system described above,
1. an "execution condition of a program" is not defined precisely, PA0 2. an order in time in which check points are to be passed is not detected, and PA0 3. production of a program is complicated because a plurality of commands including a pass state indication register setting command and a watch dog timer clearing command are used.
Therefore, the system of the document mentioned above is disadvantageous in that it cannot detect a permanent loop which includes the pass state indication register setting command by which check points are set and the watch dog timer clearing command. The system is disadvantageous also in that, upon production of a program, it is not easy for a programmer to use the system in that it is not clear what time difference should be provided to the pass state indication register setting command for check points from the watch dog timer clearing command and that the program must be produced using a conditional branch and so forth so that a program route for execution of the pass state indication register setting command and another program route which includes the watch dog timer clearing command may coincide with each other.
Also, since a check is performed at each check point, the system is disadvantageous in that it does not allow, comparison between a plurality of computers as in designing of a fault-tolerant computer system (because setting of values of check points and confirmation of the same are isolated from each other).